Andrea Arcangeli 27c73ae759 mm: hugetlbfs: fix hugetlbfs optimization ... Commit 7cb2ef56e6 ("mm: fix aio performance regression for database caused by THP") can cause dereference of a dangling pointer if split_huge_page runs during PageHuge() if there are updates to the tail_page->private field. Also it is repeating compound_head twice for hugetlbfs and it is running compound_head+compound_trans_head for THP when a single one is needed in both cases. The new code within the PageSlab() check doesn't need to verify that the THP page size is never bigger than the smallest hugetlbfs page size, to avoid memory corruption. A longstanding theoretical race condition was found while fixing the above (see the change right after the skip_unlock label, that is relevant for the compound_lock path too). By re-establishing the _mapcount tail refcounting for all compound pages, this also fixes the below problem: echo 0 >/sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages BUG: Bad page state in process bash pfn:59a01 page:ffffea000139b038 count:0 mapcount:10 mapping: (null) index:0x0 page flags: 0x1c00000000008000(tail) Modules linked in: CPU: 6 PID: 2018 Comm: bash Not tainted 3.12.0+ #25 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack+0x55/0x76 bad_page+0xd5/0x130 free_pages_prepare+0x213/0x280 __free_pages+0x36/0x80 update_and_free_page+0xc1/0xd0 free_pool_huge_page+0xc2/0xe0 set_max_huge_pages.part.58+0x14c/0x220 nr_hugepages_store_common.isra.60+0xd0/0xf0 nr_hugepages_store+0x13/0x20 kobj_attr_store+0xf/0x20 sysfs_write_file+0x189/0x1e0 vfs_write+0xc5/0x1f0 SyS_write+0x55/0xb0 system_call_fastpath+0x16/0x1b Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com> Signed-off-by: Andrea Arcangeli <aarcange@redhat.com> Tested-by: Khalid Aziz <khalid.aziz@oracle.com> Cc: Pravin Shelar <pshelar@nicira.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Ben Hutchings <bhutchings@solarflare.com> Cc: Christoph Lameter <cl@linux.com> Cc: Johannes Weiner <jweiner@redhat.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Rik van Riel <riel@redhat.com> Cc: Andi Kleen <andi@firstfloor.org> Cc: Minchan Kim <minchan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2013-11-21 16:42:27 -08:00
..
acpi	ACPI / driver core: Store an ACPI device pointer in struct acpi_dev_node	2013-11-14 23:14:43 +01:00
asm-generic	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2013-11-15 16:47:22 -08:00
clocksource
crypto
drm	Merge tag 'bdw-stage1-2013-11-08-v2' of git://people.freedesktop.org/~danvet/drm-intel into drm-next	2013-11-10 18:35:33 +10:00
dt-bindings	For the 3.13 merge window we have a couple of new drivers for the AMS	2013-11-15 16:37:40 -08:00
keys
kvm
linux	mm: hugetlbfs: fix hugetlbfs optimization	2013-11-21 16:42:27 -08:00
math-emu
media	Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2013-11-18 15:50:07 -08:00
memory
misc
net	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-11-19 15:50:47 -08:00
pcmcia
ras
rdma	Merge branches 'cma', 'cxgb4', 'flowsteer', 'ipoib', 'misc', 'mlx4', 'mlx5', 'nes', 'ocrdma', 'qib' and 'srp' into for-next	2013-11-17 08:22:19 -08:00
rxrpc
scsi	Main batch of InfiniBand/RDMA changes for 3.13:	2013-11-18 15:36:04 -08:00
sound	Merge remote-tracking branch 'asoc/topic/twl4030' into asoc-next	2013-11-08 10:43:40 +00:00
target
trace	This batch of changes is mostly clean ups and small bug fixes.	2013-11-16 12:23:18 -08:00
uapi	md update for 3.13.	2013-11-20 13:05:25 -08:00
video	fbdev changes for 3.13	2013-11-14 14:44:20 +09:00
xen	Features:	2013-11-15 13:34:37 +09:00
Kbuild